5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868.zip
Size 2.7MB
Sample260826-vmrqbashkc
SHA256 99c4b5d79e9cec03d7a01523edfebd3c0cca69fc481f72f34a9137da5f618f88
MD5 1d1bc57255452cba177068a4dacfb5e5
SHA1 840145d4f602cd1ab2781a44f7237da4f035521b
SHA512 dcff6a3acaf8b574592efbdae1f1e10dc310ecba25ed819435dd2bb96b9f0fc1ceaf9aded4437cddb4b1a21fa9ac1a1e91a7f8d40a9eb689922ed4c14717cf47
SSDEEP 49152:lMPomREyUrcYq7aAqTasOfpZ9IK8VkKWbnPLG1TY61Adf9oj7hSclt7nf:GQSEyUgp8FOWK8VkJbnDG1EXdfWvhSaT
TLSH
T1D2D533D7F0F3B303078BBA3B8A909A3F568B54E986A78C727176527663270B3C19D451
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868

File Explorer

5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868.zip

.zip 2.7MB
5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868

.exe 6.5MB

5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868.zip

SHA256 99c4b5d79e9cec03d7a01523edfebd3c0cca69fc481f72f34a9137da5f618f88
MD5 1d1bc57255452cba177068a4dacfb5e5
SHA1 840145d4f602cd1ab2781a44f7237da4f035521b
SHA512 dcff6a3acaf8b574592efbdae1f1e10dc310ecba25ed819435dd2bb96b9f0fc1ceaf9aded4437cddb4b1a21fa9ac1a1e91a7f8d40a9eb689922ed4c14717cf47
SSDEEP 49152:lMPomREyUrcYq7aAqTasOfpZ9IK8VkKWbnPLG1TY61Adf9oj7hSclt7nf:GQSEyUgp8FOWK8VkJbnDG1EXdfWvhSaT
TLSH
T1D2D533D7F0F3B303078BBA3B8A909A3F568B54E986A78C727176527663270B3C19D451
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868
MD5 238c71a7bae1cd79a1549c5e5947b5e8
SHA1 029c8cca7005504fe7da973612b4de37644a12b6
SHA512 fdc28794c364a9dbdf83995328ebc35e42583c0b0c3953952779c0ee13ad138fb216f9cc92d50598cd8d017257d495383eb2514087f0b761c338625004453094
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8S:T6BJUoROZfIA8Xf8xumvBh8huTEEmn
TLSH
T1D1665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868.zip

5d9b965cf627f8af1aeaffd7e43dc3f4ecbcff1a2868df71a17a0a9dbadc8868

kernel32

generic